ATTENTION: The new home of the Digital Forensics Wiki is at Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

Difference between revisions of "QCOW Image Format"

From ForensicsWiki
Jump to: navigation, search
(External Links)
(4 intermediate revisions by the same user not shown)
Line 32: Line 32:
== External Links ==
== External Links ==
* [ The QCOW Image Format]
* [ The QCOW Image Format], by [[Mark McLoughlin]], June 2006
* [ The QCOW2 Image Format]
* [ The QCOW2 Image Format], by [[Mark McLoughlin]], September 2008
* [ QEMU Copy-On-Write file format], by the [[libqcow|libqcow project]], December 2010
== Tools ==
* [[libqcow]]
[[Category:File Formats]]
[[Category:File Formats]]

Revision as of 05:31, 15 July 2013

QEMU uses the QEMU Copy-On-Write (QCOW) files to store a disk image.

MIME types

File signature

QCOW files start with hexadecimal: 0x51 0x46 0x49 0xfb (ASCII: "QFI.")

File types

Currently there two are versions of the QCOW format; version 1 and 2. Version 2 is the preferred format.


The QCOW format is used to store storage media data, e.g. disk images.

The QCOW image file consists of:

  • the file header
  • the L1 table (cluster aligned)
  • the reference count table (cluster aligned)
  • reference count blocks
  • snapshot headers (8-byte aligned on cluster boundary)
  • clusters containing:
    • L2 tables
    • storage media data

The clusters are 512 bytes of size


The QCOW2 format supports optional AES encryption

See Also

External Links